Under GDPR, what counts as "consent withdrawal being as easy as giving consent"?
I'm developing an evidence-based website privacy review methodology and came across an interesting edge case. I'd appreciate opinions from people familiar with GDPR and cookie consent.
During testing of a large website, I observed the following:
• On first visit, the cookie banner offered both Accept All and Reject Non-Essential.
• The banner also included a "Manage your cookie preferences anytime" link, which opened a preference center before any consent choice was made.
• After accepting or rejecting cookies, I could no longer find a reasonably discoverable way to reopen the preference center.
I checked the homepage, footer, Privacy Policy, and other obvious privacy-related links but couldn't find it.
My understanding of the GDPR is that withdrawing consent should be as easy as giving it. However, I'm trying to separate legal requirements from my own assumptions.
My question is:
If the preference center is available before consent but is no longer reasonably discoverable afterward, would you consider that compatible with the GDPR? Or is there guidance or case law suggesting otherwise?
I'm interested in evidence-based answers, including EDPB guidance, DPA decisions, or relevant case law if anyone knows of them.